<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<script>
    var m = '13365796985';
    var s = m.substr(3,4);
    console.log(s);
    var r = m.replace(s,'****');
    console.log(r);
</script>
</body>
</html>